Metasploit SMB Authentication

Status: test
Severity: high
Log source: product windows, service security
Author: Chakib Gzenayi (@Chak092), Hosni Mribah
Source: github.com/SigmaHQ/sigma

Alerts on Metasploit host's authentications on the domain.

Known false positives

Linux hostnames composed of 16 characters.

MITRE ATT&CK coverage

Tactic	Techniques
Lateral Movement	`T1021.002` Remote Services: SMB/Windows Admin Shares

Telemetry coverage

Provider	Record / event type
Security-Auditing	Event ID 4624: An account was successfully logged on.
Security-Auditing	Event ID 4625: An account failed to log on.
Security-Auditing	Event ID 4776: The domain controller attempted to validate the credentials for an account.

Rule body

title: Metasploit SMB Authentication
id: 72124974-a68b-4366-b990-d30e0b2a190d
status: test
description: Alerts on Metasploit host's authentications on the domain.
references:
    - https://github.com/rapid7/metasploit-framework/blob/1416b5776d963f21b7b5b45d19f3e961201e0aed/lib/rex/proto/smb/client.rb
author: Chakib Gzenayi (@Chak092), Hosni Mribah
date: 2020-05-06
modified: 2024-01-25
tags:
    - attack.lateral-movement
    - attack.t1021.002
logsource:
    product: windows
    service: security
detection:
    selection1:
        EventID:
            - 4625
            - 4624
        LogonType: 3
        AuthenticationPackageName: 'NTLM'
        WorkstationName|re: '^[A-Za-z0-9]{16}$'
    selection2:
        EventID: 4776
        Workstation|re: '^[A-Za-z0-9]{16}$'
    condition: 1 of selection*
falsepositives:
    - Linux hostnames composed of 16 characters.
level: high

Stages and Predicates

Stage 0: `condition`

1 of selection*

Stage 1: `selection1`

selection1:
    EventID:
        - 4625
        - 4624
    LogonType: 3
    AuthenticationPackageName: 'NTLM'
    WorkstationName|re: '^[A-Za-z0-9]{16}$'

Stage 2: `selection2`

selection2:
    EventID: 4776
    Workstation|re: '^[A-Za-z0-9]{16}$'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`AuthenticationPackageName`	eq	`NTLM` corpus 7 (sigma 5, elastic 1, splunk 1)	`field:"AuthenticationPackageName" kind:eq value:"NTLM"`
`LogonType`	eq	`3` corpus 41 (splunk 13, sigma 12, elastic 9, kusto 7)	`field:"LogonType" kind:eq value:"3"`
`Workstation`	regex_match	`^[A-Za-z0-9]{16}$`	`field:"Workstation" kind:regex_match value:"^[A-Za-z0-9]{16}$"`
`WorkstationName`	regex_match	`^[A-Za-z0-9]{16}$`	`field:"WorkstationName" kind:regex_match value:"^[A-Za-z0-9]{16}$"`

Metasploit SMB Authentication

Known false positives

MITRE ATT&CK coverage

Telemetry coverage

Rule body

Stages and Predicates

Stage 0: condition

Stage 1: selection1

Stage 2: selection2

Indicators

Stage 0: `condition`

Stage 1: `selection1`

Stage 2: `selection2`